-
Notifications
You must be signed in to change notification settings - Fork 92
HydraFW JTAG guide
This guide is updated towards firmware release HydraFW v0.10
Bus: JTAG
Connections: four pins (TMS, TCK, TDI, TDO) and one optional pin (TRST)
Output types: 3.3volt normal output, or open drain
(pull-up/pull-down resistors integrated in MCU or external).
Pull-up resistors: required for open collector output mode (2K – 10K).
Maximum Voltage: 5.5volts (5volt safe).
This guide is updated towards firmware release HydraFW v0.11 and later
-
show
Show JTAG parameters orshow pins
Show pins used in this mode -
pull
with parameterup
ordown
orfloating
to choose internal MCU pull up/down or no pull/external -
msb-first
orlsb-first
to send/receive respectively MSB first or LSB first. -
tck
,tms
,tdi
andtdo
with an integer parameter to set the corresponding pin on PB (tms 1
sets TMS on pin PB1) -
brute
withbypass
oridcode
parameters is used to discover JTAG ports on an unknown device. -
bypass
to query the number of devices in the JTAG chain. -
idcode
to get the devices IDCODEs in the JTAG chain. -
openocd
to switch to openOCD mode. See OpenOCD guide -
exit
to exit JTAG mode
> jtag
Device: JTAG1
GPIO resistor: floating
Bit order: LSB first
Hardware Informations:
jtag1> show pins
TMS:PB10 TCK:PB11 TDI:PB8 TDO:PB9 TRST:PB7
^
to send one clock tick
/
to set TCK level high
\
to set TCK level low
-
to set TDI level high
_
to set TDI level low
[
to set TMS level high
]
to set TMS level low
!
to read TDO with clock tick
.
to read TDO without clock tick
Connect several test pins on the board to analyze on HydraBus PBx pins, and run :
jtag1> brute idcode 10
Bruteforce on 10 pins.
TMS:PB0 TCK:PB3 TDI:Unused TDO:PB2 TRST:Unused
jtag1> brute bypass 8
Bruteforce on 8 pins.
TMS:PB0 TCK:PB3 TDI:PB1 TDO:PB2 TRST:Unused
jtag1> idcode
Device found. IDCODE : 3F0F0F0F
jtag1> bypass
Number of devices found : 1
For more details on JTAG see: https://en.wikipedia.org/wiki/Joint_Test_Action_Group
- CHANGELOG
- Console commands
- Binary mode guide
-
NFC/HydraNFC v1 guide
- Read UID of an ISO/IEC_14443 Tag
- Read UID and data of a MIFARE Ultralight Tag
- Read UID of an ISO/IEC 15693 Tag
- Emul ISO14443a Tag
- Emul MIFARE Ultralight Tag
- Emul Mifare Classic Tag
- Unique NFC sniffer design
- Launch NFC sniffer from console
- Sniffer ISO14443A wireshark pcap
- Autonomous/stand-alone sniffer mode
- Sniffer ISO14443A real-time infinite trace mode
- HydraFW-HydraNFC-v1.x-TRF7970A-Tutorial